KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddns_wan_list_show of the file ddns_wan_list_show.cgi of the component DDNS Handler. The manipulation of the argument user_idN/passwordN leads to information disclosure. The attack may be initiated…
Wstrzyknięcie SQL w aaPanel umożliwia zdalne wykonanie kodu.
A security vulnerability has been detected in DT42 BerryNet up to 3.10.2. The affected element is the function DLModelManager.get_model_meta of the file berrynet/dlmodelmgr.py of the component Model Package Metadata Handler. The manipulation of the argument label leads to path traversal. The…
A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack can…
Wtyczka multi-session w better-auth umożliwia usunięcie dowolnych tokenów sesji przez fałszywe ciasteczka.
Wstrzyknięcie skryptów w 1Panel-dev MaxKB umożliwia zdalne ataki XSS.
A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the file searchresults.php. Executing a manipulation of the argument searchbox can lead to cross site scripting. The attack can be launched remotely. The exploit…
Wykorzystanie luki w go-sonic umożliwia zdalne przeprowadzenie ataku typu server-side request forgery.
A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsearch_backend.py of the component more_like_this Template Tag Handler. Such manipulation of the argument result_class leads to improper neutralization of…
A vulnerability has been found in OpenWGA 7.11.12 Build 737. This impacts an unknown function of the component Admin UI. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted…
Wstrzyknięcie skryptu w Iqbolshoh php-business-website umożliwia atak XSS zdalnie.
Podatność w Domoticz umożliwia atakującym kradzież ciasteczek sesyjnych przez XSS.
A security flaw has been discovered in osCommerce osCommerce2 up to 2.3.4.1. This vulnerability affects the function include of the file admin/newsletters.php of the component Newsletter Management. Performing a manipulation of the argument module results in code injection. The attack is possible…
A security vulnerability has been detected in Eigenfocus up to 1.4.0. This vulnerability affects unknown code of the component Description Handler. The manipulation of the argument entry.description/time_entry.description leads to cross site scripting. The attack is possible to be carried out…
A vulnerability has been found in idcCMS 1.70. Affected is an unknown function of the file admin/member_deal.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/RoleController.java of the component User Detail Endpoint. This manipulation of the argument ID causes…
A vulnerability was found in ketr JEPaaS up to 7.2.8. This impacts the function readAllPostil of the file /je/postil/postil/readAllPostil. Performing a manipulation of the argument keyWord results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be…
Luka w yourmaileyes MOOC umożliwia zdalne wykonanie ataku XSS przez manipulację argumentem.
Wstrzyknięcie skryptów w Yealink SIP-T21P E2 umożliwia zdalne ataki XSS.
Podatność w Grandstream GXP1625 umożliwia zdalne wykonanie ataku XSS.
A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requires a local approach. The exploit has…
A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Such manipulation of the argument schema_name leads to missing…
A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file loginsystem/admin/change-password.php of the component Change Password Handler. This manipulation of the argument currentpassword causes…
A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java of the component Parameter Submit Management. The manipulation of the argument…
Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered…
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| A vulnerability has been found in Netcore NR268 1.7.121109. | A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddns_wan_list_show of the file ddns_wan_list_show.cgi of the component DDNS Handler. The manipulation of the argument user_idN/passwordN leads to information disclosure. The attack may be initiated… |
Do wiadomości | 2,0 | 0,28 % | ||
| Wstrzyknięcie SQL w aaPanel umożliwia zdalne wykonanie kodu. | Wstrzyknięcie SQL w aaPanel umożliwia zdalne wykonanie kodu. |
Do wiadomości | 2,0 | 0,27 % | ||
| A security vulnerability has been detected in DT42 BerryNet up to 3.10.2. | A security vulnerability has been detected in DT42 BerryNet up to 3.10.2. The affected element is the function DLModelManager.get_model_meta of the file berrynet/dlmodelmgr.py of the component Model Package Metadata Handler. The manipulation of the argument label leads to path traversal. The… |
Do wiadomości | 2,0 | 0,27 % | ||
| A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. | A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack can… |
Do wiadomości | 2,0 | 0,27 % | ||
| Wtyczka multi-session w better-auth umożliwia usunięcie dowolnych tokenów sesji przez fałszywe ciasteczka. | Wtyczka multi-session w better-auth umożliwia usunięcie dowolnych tokenów sesji przez fałszywe ciasteczka. |
Do wiadomości | 2,0 | 0,27 % | ||
| Wstrzyknięcie skryptów w 1Panel-dev MaxKB umożliwia zdalne ataki XSS. | Wstrzyknięcie skryptów w 1Panel-dev MaxKB umożliwia zdalne ataki XSS. |
Do wiadomości | 2,0 | 0,27 % | ||
| A vulnerability was determined in SourceCodester Simple Student Information System 1.0. | A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the file searchresults.php. Executing a manipulation of the argument searchbox can lead to cross site scripting. The attack can be launched remotely. The exploit… |
Do wiadomości | 2,0 | 0,26 % | ||
| Wykorzystanie luki w go-sonic umożliwia zdalne przeprowadzenie ataku typu server-side request forgery. | Wykorzystanie luki w go-sonic umożliwia zdalne przeprowadzenie ataku typu server-side request forgery. |
Do wiadomości | 2,0 | 0,26 % | ||
| A vulnerability has been found in django-haystack up to 3.3.0. | A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsearch_backend.py of the component more_like_this Template Tag Handler. Such manipulation of the argument result_class leads to improper neutralization of… |
Do wiadomości | 2,0 | 0,25 % | ||
| A vulnerability has been found in OpenWGA 7.11.12 Build 737. | A vulnerability has been found in OpenWGA 7.11.12 Build 737. This impacts an unknown function of the component Admin UI. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted… |
Do wiadomości | 2,0 | 0,25 % | ||
| Wstrzyknięcie skryptu w Iqbolshoh php-business-website umożliwia atak XSS zdalnie. | Wstrzyknięcie skryptu w Iqbolshoh php-business-website umożliwia atak XSS zdalnie. |
Do wiadomości | 2,0 | 0,25 % | ||
| Podatność w Domoticz umożliwia atakującym kradzież ciasteczek sesyjnych przez XSS. | Podatność w Domoticz umożliwia atakującym kradzież ciasteczek sesyjnych przez XSS. |
Do wiadomości | 2,0 | 0,25 % | ||
| A security flaw has been discovered in osCommerce osCommerce2 up to 2.3.4.1. | A security flaw has been discovered in osCommerce osCommerce2 up to 2.3.4.1. This vulnerability affects the function include of the file admin/newsletters.php of the component Newsletter Management. Performing a manipulation of the argument module results in code injection. The attack is possible… |
Do wiadomości | 2,0 | 0,25 % | ||
| A security vulnerability has been detected in Eigenfocus up to 1.4.0. | A security vulnerability has been detected in Eigenfocus up to 1.4.0. This vulnerability affects unknown code of the component Description Handler. The manipulation of the argument entry.description/time_entry.description leads to cross site scripting. The attack is possible to be carried out… |
Do wiadomości | 2,0 | 0,25 % | ||
| A vulnerability has been found in idcCMS 1.70. | A vulnerability has been found in idcCMS 1.70. Affected is an unknown function of the file admin/member_deal.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. |
Do wiadomości | 2,0 | 0,24 % | ||
| A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. | A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/RoleController.java of the component User Detail Endpoint. This manipulation of the argument ID causes… |
Do wiadomości | 2,0 | 0,24 % | ||
| A vulnerability was found in ketr JEPaaS up to 7.2.8. | A vulnerability was found in ketr JEPaaS up to 7.2.8. This impacts the function readAllPostil of the file /je/postil/postil/readAllPostil. Performing a manipulation of the argument keyWord results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be… |
Do wiadomości | 2,0 | 0,24 % | ||
| Luka w yourmaileyes MOOC umożliwia zdalne wykonanie ataku XSS przez manipulację argumentem. | Luka w yourmaileyes MOOC umożliwia zdalne wykonanie ataku XSS przez manipulację argumentem. |
Do wiadomości | 2,0 | 0,23 % | ||
| Wstrzyknięcie skryptów w Yealink SIP-T21P E2 umożliwia zdalne ataki XSS. | Wstrzyknięcie skryptów w Yealink SIP-T21P E2 umożliwia zdalne ataki XSS. |
Do wiadomości | 2,0 | 0,23 % | ||
| Podatność w Grandstream GXP1625 umożliwia zdalne wykonanie ataku XSS. | Podatność w Grandstream GXP1625 umożliwia zdalne wykonanie ataku XSS. |
Do wiadomości | 2,0 | 0,23 % | ||
| A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. | A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0. Affected is an unknown function of the file src/index.ts of the component Advanced Search Tool. The manipulation of the argument fileType results in os command injection. The attack requires a local approach. The exploit has… |
Do wiadomości | 1,9 | 0,73 % | ||
| A vulnerability has been found in David-Crty Databasement up to 1.8.1. | A vulnerability has been found in David-Crty Databasement up to 1.8.1. Affected by this vulnerability is an unknown functionality of the file app/Http/Requests/Api/V1/SaveScheduledRestoreRequest.php of the component Scheduled Restore. Such manipulation of the argument schema_name leads to missing… |
Do wiadomości | 2,0 | 0,23 % | ||
| A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. | A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file loginsystem/admin/change-password.php of the component Change Password Handler. This manipulation of the argument currentpassword causes… |
Do wiadomości | 2,0 | 0,23 % | ||
| A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. | A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java of the component Parameter Submit Management. The manipulation of the argument… |
Do wiadomości | 2,0 | 0,23 % | ||
| Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and… | Kimai before 2.53.0 fails to block sensitive User methods in the Twig invoice template sandbox, allowing admins to call getApiToken() and getPlainApiToken() methods. Attackers with template creation permissions can embed these method calls in invoice templates to leak hashed API tokens in rendered… |
Do wiadomości | 2,0 | 0,23 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.